Manage Encrypted Shared Folders

In Control Panel > Shared Folder, you can click on an encrypted shared folder and manage its mount status or encryption key from the Encryption drop-down menu. The options available in this menu are different for each shared folder based on its encryption or mount statuses.

Managing Encryption Keys in Key Manager

You can save encryption keys of encrypted shared folders in Key Manager. You can then use the saved encryption keys to mount or unmount multiple shared folders at the same time.

To initialize a key store:

1. Go to Control Panel > Shared Folder > Encryption > Key Manager.
2. Select an external device or system partition as the key store from Key Store Location. We recommend using an external device because it is safer to store the encrypted file and the corresponding key in different devices.
3. Enter a passphrase into the Passphrase field for this key store.
4. Click Initialize to save the settings.

To add a new key to a key store:

1. Make sure you that you have initialized a key store.
2. Go to Control Panel > Shared Folder > Encryption > Key Manager.
3. Click Add.
4. Select an encrypted shared folder.
5. Select the cypher for the encryption key. You can select either Passphrase or Machine key.

   Note: Only Machine key supports automatically mount encrypted shared folders on boot.

6. Enter or import the encryption key.
7. Click OK to save the settings.

To manually mount multiple encrypted shared folders:

1. Make sure that you have added keys to the key store.
2. Go to Control Panel > Shared Folder > Encryption > Key Manager.
3. Select the encrypted shared folders you want to mount.
4. Go to Encryption > Mount.

To automatically mount multiple encrypted shared folders on boot:

1. Make sure that you have added keys to the key store.
2. Go to Control Panel > Shared Folder > Encryption > Key Manager.
3. Tick Mount on Boot for the encrypted shared folders you want to mount on boot.
4. Click OK to save the settings.

Note: Only Machine key supports automatically mount encrypted shared folders on boot.

To eject a key store after boot if you are using an external device as key store (recommended for security reasons):

1. Go to Control Panel > Shared Folder > Encryption > Key Manager.
2. Click Configure.
3. Tick Eject device after boot.
4. Click OK to save the settings.

To use Key Manager to manage existing encryption keys for shared folders automatically mounted on boot:

This is applicable to shared folders created on or before DSM 6.0. To manage the keys with Key Manager, migrate the keys through either of the following methods.

Migrate keys during key store initialization:

1. When initializing a key store, tick Migrate all encryption keys to this key store for safekeeping.

Migrate keys manually:

1. Go to Control Panel > Shared Folder > Encryption > Key Manager.
2. Click Configure.
3. Click Migrate now under Key Migration.
4. If there are duplicate keys, you can choose to Overwrite duplicate keys.
5. Click OK to save the settings.

   Note: Only encryption keys of shared folders created on or before DSM 6.0 that were automatically mounted can be migrated all at once using the Migrate now function.

To clone a key store in High Availability mode:

1. Connect two external devices to the active server.
2. Go to Control Panel > Shared Folder > Encryption > Key Manager.
3. Click Clone.
4. Select a shared folder from Source Key Store.
5. Select a shared folder from Destination Key Store.
6. Click OK to save the settings.

Note:

• When in High Availability mode, if the encryption key is stored on the external devices connected to the active server, the encryption key will not be available for mounting encrypted shared folder on the new active server after switchover or auto failover. In this case, connect one of the external devices to the new active server to mount encrypted shared folders.